Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _test_server(cls, targetStr, shared_settings):
"""Test connectivity to one single server."""
# Parse the target string
try:
defaultPort = cls.DEFAULT_PORTS[shared_settings['starttls']]
except KeyError:
defaultPort = cls.DEFAULT_PORTS['default']
(host, port) = TargetStringParser.parse_target_str(targetStr, defaultPort)
# First try to connect and do StartTLS if needed
sslCon = create_sslyze_connection((host, host, port, SSLV23), shared_settings)
try:
sslCon.do_pre_handshake()
ipAddr = sslCon._sock.getpeername()[0]
# Socket errors
except socket.timeout: # Host is down
raise InvalidTargetError(targetStr, cls.ERR_TIMEOUT)
except socket.gaierror:
raise InvalidTargetError(targetStr, cls.ERR_NAME_NOT_RESOLVED)
except socket.error: # Connection Refused
raise InvalidTargetError(targetStr, cls.ERR_REJECTED)
# StartTLS errors
except StartTLSError as e:
raise InvalidTargetError(targetStr, e[0])
def create_sslyze_connection(shared_settings, sslVersion=SSLV23, sslVerifyLocations=None):
"""
Utility function to create the proper SSLConnection based on what's
in the shared_settings. All plugins should use this for their SSL
connections.
"""
# Create the proper SMTP / XMPP / HTTPS / Proxy connection
timeout = shared_settings['timeout']
if shared_settings['starttls'] == 'smtp':
sslConn = SMTPConnection(sslVersion, sslVerifyLocations, timeout)
elif shared_settings['starttls'] == 'ftp':
sslConn = FTPConnection(sslVersion, sslVerifyLocations, timeout)
elif shared_settings['starttls'] == 'xmpp':
raise InvalidTargetError(targetStr, e[0])
# Other errors
except Exception as e:
raise InvalidTargetError(targetStr, '{0}: {1}'.format(str(type(e).__name__), e[0]))
finally:
sslCon.close()
# Then try to do SSL handshakes just to figure out the SSL version
# supported by the server; the plugins need to know this in advance.
# If the handshakes fail, we keep going anyway; maybe the server
# only supports exotic cipher suites
sslSupport = SSLV23
# No connection retry when testing connectivity
tweak_shared_settings = shared_settings.copy()
tweak_shared_settings['nb_retries'] = 1
for sslVersion in [TLSV1, SSLV23, SSLV3, TLSV1_2]:
sslCon = create_sslyze_connection((host, ipAddr, port, sslVersion),
tweak_shared_settings)
try:
sslCon.connect()
except:
pass
else:
sslSupport = sslVersion
break
finally:
sslCon.close()
def process_task(self, target, command, args):
(host, ip, port, sslVersion) = target
if sslVersion == SSLV23: # Could not determine the preferred SSL version - client cert was required ?
sslVersion = TLSV1 # Default to TLS 1.0
target = (host, ip, port, sslVersion)
sslConn = create_sslyze_connection(target, self._shared_settings)
sslConn.sslVersion = sslVersion # Needed by the heartbleed payload
# Awful hack #1: replace nassl.sslClient.do_handshake() with a heartbleed
# checking SSL handshake so that all the SSLyze options
# (startTLS, proxy, etc.) still work
sslConn.do_handshake = new.instancemethod(do_handshake_with_heartbleed, sslConn, None)
heartbleed = None
try: # Perform the SSL handshake
sslConn.connect()
except HeartbleedSent:
# Awful hack #2: directly read the underlying network socket